Customer Data in Hong Kong Franchises: Clarify Usage Rights and Privacy Responsibilities Before Signing

When buying a franchise business in Hong Kong, membership lists, booking records and purchase histories are often presented as strengths of the brand’s operations. Yet being able to log into a system does not necessarily mean you can download customer lists or send out your own offers. Clarifying data usage rights before signing protects customers and helps franchisees avoid paying system fees without access to the information they need for day-to-day operations.

1. Distinguish contractual rights from statutory responsibilities

Hong Kong has no legislation specifically governing the offering and sale of franchises, nor any mandatory disclosure regime or registration requirement specifically for franchising. The parties’ rights and responsibilities are largely defined by their contract and common law principles. However, anyone handling customers’ personal data must still comply with the Personal Data (Privacy) Ordinance (Cap. 486). Operating as a franchise also provides no exemption from general business registration or applicable licensing requirements.

Under the Ordinance, the term ‘data user’ focuses on who controls the collection, holding, processing or use of personal data, rather than simply who supplies the servers or owns the brand. The franchisor and franchisee may each bear responsibility for different activities. A contractual statement that ‘all data is the franchisor’s responsibility’ cannot, by itself, remove a franchisee’s statutory obligations.

Before signing, list scenarios such as membership registration, online orders, in-store bookings and after-sales enquiries, and confirm the following for each:

• Who decides which data to collect and why?
• Whose Personal Information Collection Statement does the customer see?
• Who can view, amend, export or delete the data?
• Who receives and follows up customers’ requests to access or correct their data?

Do not simply ask, ‘Who owns the list?’ Commercial arrangements for using data cannot override customers’ rights under privacy law.

2. Test the scope of data access before paying

Ask the franchisor to demonstrate its membership and sales systems using fictional test data; there is no need to obtain real customer lists. The key question is not whether the interface looks attractive, but whether the franchised outlet can process refunds, verify loyalty points, handle complaints and provide after-sales service.

For example, a customer might order through the brand’s website and collect from a franchised outlet. If the outlet can see only the order number, but not the records needed to process a refund, its service responsibilities may not match its access rights. Ask the franchisor to explain the procedure rather than accepting a vague promise that ‘customer services will help later’.

Record essential permissions in the contract or a schedule, including the data fields available to view, permitted purposes, download restrictions, access logs and support response arrangements. Also establish whether the franchisor can unilaterally reduce permissions, disable accounts or increase data export fees.

When assessing customer reports supplied by the brand, start by requesting statistics that do not identify individual customers, such as repeat-purchase patterns and order distribution. If the purpose can be achieved with less data, access to the full membership list should not be treated as the sole measure of a franchise’s value.

3. Separate marketing from routine customer service

A customer who supplies a telephone number for collection notifications has not necessarily agreed to receive promotional messages from the franchised outlet. Personal data should generally be used for its original collection purpose or a directly related purpose. Using it for a new purpose will usually require the data subject’s prescribed consent.

The Personal Data (Privacy) Ordinance also contains direct marketing provisions. Before using personal data for direct marketing, businesses must comply with the applicable requirements to inform customers of the intended use, the kinds of data involved and the classes of marketing subjects, and obtain the necessary consent. They must also stop the relevant use when a customer opts out. Separate requirements apply when providing data to another party for direct marketing; sharing within a brand should not be assumed to qualify automatically for an exemption.

Franchisees should ask the franchisor for template registration forms and privacy statements, and have them checked by an adviser familiar with Hong Kong privacy law. In particular, confirm that the statements cover the actual legal entity operating the franchised outlet, rather than just the brand name.

The contract should also allocate responsibility for keeping consent records, updating opt-out lists, approving marketing lists and dealing with messages sent in error. If the franchisor and outlet send messages separately, they need a procedure for synchronising opt-out requests so that customers who unsubscribe with one party do not continue receiving offers from the other.

4. Plan for outsourcing, incidents and exit arrangements

The membership system may be run by an outsourced supplier, or its data may be stored outside Hong Kong. Before signing, establish who the service providers are, how and where data is stored, who is authorised to access it and what security measures apply. Do not simply accept the claim that ‘it is secure because it uses the cloud’.

The Ordinance’s Data Protection Principles require practicable security measures. When engaging a data processor to handle personal data, contractual or other measures must also be used to prevent data from being retained longer than necessary and to prevent unauthorised or accidental access, processing, erasure, loss or use. The franchise agreement should support these responsibilities by specifying tiered access permissions, account deactivation when staff leave, backups and incident reporting procedures.

Ask the franchisor to specify who will restrict access, preserve records, assess the impact and decide whether to notify affected individuals or the relevant authority after a data breach is discovered. Any internal notification deadline agreed between the parties is a contractual arrangement and should not be misrepresented as a deadline universally required by Hong Kong law.

Exit arrangements are equally important. The contract should distinguish between outstanding orders, refund records, statutory retention requirements and marketing lists that are no longer needed, with separate procedures for transferring data, restricting its use or deleting it. Franchisees should not assume they can take membership lists with them and continue marketing. Equally, the franchisor should avoid disabling accounts in a way that leaves an outlet unable to handle customer claims for which it remains responsible. Necessary records should be handled for lawful purposes, limited to the minimum required and kept for an appropriate period.

Practical takeaway: Before paying, ask the franchisor for a table setting out ‘data, purposes, permissions, responsibilities and retention periods’, then incorporate the essential rights into the contract. If the franchisor cannot explain how customer data flows between the parties, clarify the arrangements before opening rather than trying to fix them afterwards.